Medical Law and Ethics — Certified Clinical Medical Assistant (CCMA) Practice Test
21 questions in this topic · 21 drawn at random this round
Under the HIPAA Privacy Rule, which of the following is the best description of protected health information (PHI)?
Session Progress
This Certified Clinical Medical Assistant (CCMA) Medical Law and Ethics practice set has 21 practice questions based on the official exam materials, each with an instant explanation.
Sample questions
Three questions from the Medical Law and Ethics bank with the correct answer and an explanation. The practice quiz above draws 21 questions at random from the same bank.
Under the HIPAA Privacy Rule, which of the following is the best description of protected health information (PHI)?
- Individually identifiable health information created or maintained by a covered entity, in any form — Correct answer
- Only information that is stored in an electronic health record
- Only laboratory and imaging results that reveal a diagnosis
- Any medical information, even when all identifiers have been removed
Explanation: Per NHA Domain 7 (k214/k220) and the HIPAA Privacy Rule (HHS), PHI is individually identifiable health information held or transmitted by a covered entity in any form or medium — oral, paper, or electronic. It is not limited to electronic records or to lab/imaging results. De-identified information (with all identifiers removed) is no longer PHI, so the last option is incorrect.
Handbook: Medical Law & Ethics — HIPAA: Protected Health Information (NHA Domain 7, k214/k220; HIPAA Privacy Rule, HHS)
The HIPAA 'minimum necessary' standard requires that a medical assistant do which of the following when using or disclosing PHI?
- Access or share only the smallest amount of PHI needed to accomplish the intended purpose — Correct answer
- Share the patient's complete chart whenever another staff member requests it
- Provide all available PHI to any insurer that asks for it
- Withhold all PHI, including from the treating provider
Explanation: Per NHA Domain 7 (k220) and the HIPAA Privacy Rule, the minimum necessary standard limits access, use, and disclosure of PHI to the least amount required to accomplish the purpose. Sharing an entire chart on request or giving an insurer everything it asks for violates this standard; withholding PHI from the treating provider would obstruct treatment, which is a permitted use.
Handbook: Medical Law & Ethics — HIPAA: Minimum Necessary Standard (NHA Domain 7, k220; HIPAA Privacy Rule, HHS)
Which disclosure of PHI is permitted under HIPAA WITHOUT obtaining a separate patient authorization?
- Sending records to a consulting specialist for the patient's treatment — Correct answer
- Releasing records to the patient's employer for a hiring decision
- Giving records to a life insurance company evaluating an application
- Selling a patient mailing list to a pharmaceutical marketing firm
Explanation: Per NHA Domain 7 (k220) and the HIPAA Privacy Rule, disclosures for treatment, payment, and health care operations (TPO) do not require a separate authorization; sending records to a consulting specialist is a treatment disclosure. Releasing PHI to an employer, to a life insurer, or for marketing/sale requires the patient's written authorization.
Handbook: Medical Law & Ethics — HIPAA: Treatment/Payment/Operations Disclosures (NHA Domain 7, k220; HIPAA Privacy Rule, HHS)